import sys
import frida


def on_message(message, data):
    if message['type'] == 'send':
        d = message['payload']
        print("[*] {0}".format(d))
    else:
        print(message)


js_code = '''
//sig
function byteToString(arr) {  
    if(typeof arr === 'string') {  
        return arr;  
    }  
    var str = '',  
        _arr = arr;  
    for(var i = 0; i < _arr.length; i++) {  
        var one = _arr[i].toString(2),  
            v = one.match(/^1+?(?=0)/);  
        if(v && one.length == 8) {  
            var bytesLength = v[0].length;  
            var store = _arr[i].toString(2).slice(7 - bytesLength);  
            for(var st = 1; st < bytesLength; st++) {  
                store += _arr[st + i].toString(2).slice(2);  
            }  
            str += String.fromCharCode(parseInt(store, 2));  
            i += bytesLength - 1;  
        } else {  
            str += String.fromCharCode(_arr[i]);  
        }  
    }  
    return str;  
}  
var log=console.log
Java.perform(
    function(){
        var cpu=Java.use('com.yxcorp.gifshow.util.CPU')
        cpu.getClock.implementation=function(v1,v2,v3){
            log('v1',v1)
            //send(v2)
            log('v2',byteToString(v2))
            log('v3',v3)
            var res=this.getClock(v1,v2,v3)
            log('res',res)
            return res
        }
    }
)
'''
js_code1 = '''
var log=console.log
Java.perform(
    function(){
        var a= Java.use('s.h1.v.w.a')
        a.b.implementation=function(v1,v2){
            log('v1',v1)
            log('v2',v2)
            var res=this.b(v1,v2)
            console.log('res',res)
            return res
        }
    }
)
'''
js_code2 = '''
//sig3
var log=console.log
function byteToString(arr) {  
    if(typeof arr === 'string') {  
        return arr;  
    }  
    var str = '',  
        _arr = arr;  
    for(var i = 0; i < _arr.length; i++) {  
        var one = _arr[i].toString(2),  
            v = one.match(/^1+?(?=0)/);  
        if(v && one.length == 8) {  
            var bytesLength = v[0].length;  
            var store = _arr[i].toString(2).slice(7 - bytesLength);  
            for(var st = 1; st < bytesLength; st++) {  
                store += _arr[st + i].toString(2).slice(2);  
            }  
            str += String.fromCharCode(parseInt(store, 2));  
            i += bytesLength - 1;  
        } else {  
            str += String.fromCharCode(_arr[i]);  
        }  
    }  
    return str;  
}
Java.perform(
    function(){
        var KSecurity=Java.use('com.kuaishou.android.security.KSecurity')
        KSecurity.atlasSign.implementation=function(v1){
            log('v1',v1)
            var res=this.atlasSign(v1)
            console.log('res',res)
            return res
        }
        var h=Java.use('com.kuaishou.android.security.matrix.h')
        h.b.overload('java.lang.String', 'boolean', 'java.lang.String').implementation=function(v1,v2,v3){
            log('v11b',v1)
            log('v12b',v2)
            log('v13b',v3)
            var res1b=this.b(v1,v2,v3)
            console.log('res1b',res1b)
            return res1b
        }
        var i=Java.use('com.kuaishou.android.security.kfree.c.i')
        i.j.implementation=function(){
            var kres=this.j()
            log('kres',byteToString(kres))
            send(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Exception").$new()));
            return kres
        }
        var JNICLibrary=Java.use('com.kuaishou.android.security.mainplugin.JNICLibrary')
        log(JNICLibrary)
        JNICLibrary.doCommandNative.implementation=function(v1,v2){
            log('mainplugin1',v1)
            log('mainplugin2',v2)
            log('mainplugin21',v2[0][0])
            log('mainplugin22',v2[1])
            log('mainplugin23',v2[2])
            log('mainplugin24',v2[3])
            log('mainplugin25',v2[4])
            log('mainplugin26',v2[5])
            log('mainplugin27',v2[6])
            log('mainplugin28',v2[7])
            var mainpluginres=this.doCommandNative(v1,v2)
            log('mainpluginres',mainpluginres)
            return mainpluginres
        }
    }
)

'''
js_code3 = '''
//token salt
var log=console.log
Java.perform(
    function(){
        var a= Java.use('m0.a.c.a.a.h.a')
        a.e.overload('java.lang.String').implementation=function(v1){
                    

            log('v1',v1)
            var res=this.e(v1)
            console.log('res',res)
            return res
        }
        var x=Java.use('s.d0.o.c0.x')
        x.a.overload('java.lang.String', 'java.lang.String').implementation=function(v1,v2){
        send(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Exception").$new()));
        log('v11',v1)
        log('v12',v2)
            var res1=this.a(v1,v2)
            console.log('res1',res1)
            return res1
        }
        var m=Java.use('s.h1.v.m')
        m.a.overload().implementation=function(){
            console.log('m1')
            var m1_res=this.a()
            console.log('m1_res',m1_res)
            return m1_res
        }
        m.a.overload('okhttp3.Request').implementation=function(v1){
            console.log('m2',v1)
            var m2_res=this.a(v1)
            console.log('m2_res',m2_res)
            return m2_res
        }
        m.a.overload('java.util.Map').implementation=function(v1){
            console.log('m3',v1)
            var m3_res=this.a(v1)
            console.log('m3_res',m3_res)
            return m3_res
        }
        m.a.overload('java.lang.String', 'double').implementation=function(v1,v2){
            console.log('m41',v1)
            console.log('m42',v2)
            var m4_res=this.a(v1,v2)
            console.log('m4_res',m4_res)
            return m4_res
        }
        m.a.overload('okhttp3.Request', 'java.util.Map', 'java.util.Map', 'java.lang.String').implementation=function(v1,v2,v3,v4){
            console.log('m51',v1)
            console.log('m52',v2)
            console.log('m53',v3)
            console.log('m54',v4)
            var m5_res=this.a(v1,v2,v3,v4)
            console.log('m5_res',m5_res)
            return m5_res
        }
    }
)
'''

js_code4 = '''
Java.perform(
    function(){
        var KSecurityContext= Java.use('com.kuaishou.android.security.adapter.common.KSecurityContext')
        KSecurityContext.setDid.implementation=function(v1){
            console.log(v1)
            this.setDid(v1)
            send(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Exception").$new()));
        }
        var t4=Java.use('s.h1.i.p9.t4')
        t4.c.overload().implementation=function(){
            var res_c=this.c()
            console.log('res_c',res_c)
            return res_c
        }
        t4.h.overload().implementation=function(){
            var res_h=this.h()
            console.log('res_h',res_h)
            return res_h
        }
        t4.k.overload().implementation=function(){
            var res_k=this.k()
            console.log('res_k',res_k)
            return res_k
        }
        var app=Java.use('com.kwai.hotfix.entry.ApplicationLike')
        app.ApplicationLike.implementation=function(v1,v2,v3,v4,v5,v6){
            console.log(v1)
            console.log(v2)
            console.log(v3)
            console.log(v4)
            console.log(v5)
            console.log(v6)
            this.ApplicationLike(v1,v2,v3,v4,v5,v6)
        }
        
    }
)
'''
js_code5 = '''
//queryid
Java.perform(
    function(){
        var ResultParamsBuilder=Java.use('com.yxcorp.plugin.search.api.ResultParamsBuilder')
        ResultParamsBuilder.a.overload().implementation=function(){
            //console.log('v1',v1)
            //console.log('v2',v2)
            var res=this.a()
            send(res)
            return res
        }
        ResultParamsBuilder.e.overload('java.lang.String').implementation=function(v1){
        console.log('v1',v1)
        send(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Exception").$new()));
        var e_res=this.e(v1)
        console.log('e_res',e_res)
        return e_res
        }
        var SearchFragmentDelegate=Java.use('com.yxcorp.plugin.search.delegate.SearchFragmentDelegate')
        SearchFragmentDelegate.a.overload('s.h1.t.p.z.q', 's.h1.t.p.r', 'java.lang.String').implementation=function(v1,v2,v3){
            console.log('a_v1',v1)
            console.log('a_v2',v2)
            console.log('a_v3',v3)
            this.a(v1,v2,v3)
        }
        var q=Java.use('s.h1.t.p.z.q')
        q.simpleContext.implementation=function(v1){
        console.log('simpleContext_v1',v1)
        var simpleContext_res=this.simpleContext(v1)
        console.log('simpleContext_res',simpleContext_res)
        return simpleContext_res
        }
        var o1=Java.use('s.h1.t.p.x0.o1')
        o1.b.overload('java.lang.String').implementation=function(v1){
        console.log('o1_v1',v1)
        var so1_res=this.b(v1)
        console.log('so1_res',so1_res)
        return so1_res
        }
    }
)
'''

js_code6 = '''
Java.perform(
    function(){
        var ResultParamsBuilder=Java.use('com.yxcorp.plugin.search.api.ResultParamsBuilder')
        ResultParamsBuilder.c.overload('java.lang.String').implementation=function(v1){
            console.log('c_v1',v1)
            send(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Exception").$new()));
            var c_res=this.c(v1)
            console.log('c_res',c_res)
            return c_res
        }
    }
)

'''

js_code7 = '''
//did

Java.perform(
    function(){
        var KSecurityContext=Java.use('com.kuaishou.android.security.adapter.common.KSecurityContext')
        KSecurityContext.setDid.implementation=function(did){
            console.log('did',did)
            send(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Exception").$new()));
            this.setDid(did)
        }
        var t4=Java.use('s.h1.i.p9.t4')
        t4.k.overload().implementation=function(){
        var res_k=this.k()
        console.log('res_k',res_k)
                    //send(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Exception").$new()));
                    return res_k

        }
        var k=Java.use('s.c0.a.m.k')
        k.c.overload('java.lang.String').implementation=function(v1){
            console.log(1)
            return this.c(v1)
        }
        var g=Java.use('s.d0.b0.a.x.g')
        g.a.overload('android.content.Context', 'java.lang.String').implementation=function(v1,v2){
            console.log(2)
            return this.a(v1,v2)
        }
        t4.c.overload('java.lang.String').implementation=function(v1){
            console.log(3)
            return this.c(v1)
        }

        
        /*
        KSecurityContext.setEgid.implementation=function(egid){
            console.log('egid',egid)
            send(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Exception").$new()));
            this.setDid(egid)
        }*/
    }
)
'''
str_host = '10.254.8.246'
manager = frida.get_device_manager()
device = manager.add_remote_device(str_host)
# package = 'com.smile.gifmaker'
# process=remote_device.attach(package)
# script=process.create_script(js_code)
# script.on('message', on_message)
# script.load()
# create_script
# get_script(package, js_code7)
# sys.stdin.read()
# device = frida.get_usb_device(-1)
pid = device.spawn(['com.smile.gifmaker'])
print(pid)
process = device.attach(pid)
#
script = process.create_script(js_code)
script.on('message', on_message)
print('[*] Running CTF')
script.load()
device.resume(pid)
print(1)
sys.stdin.read()
# 'mod=Xiaomi(MI 5)&abi=arm32&country_code=cn&kpn=KUAISHOU&deviceBit=0&oc=SHENMA_SEM_FEISUO,74&egid=DFP85891D4542239E85F56593A3577E46D1FD65F690449E98E4F00BA9E3BC169&sbh=72&hotfix_ver=&sh=1920&appver=9.0.10.18068&cold_launch_time_ms=1625726903606&nbh=0&socName=Qualcomm MSM8996&newOc=SHENMA_SEM_FEISUO,74&androidApiLevel=23&max_memory=256&isp=CMCC&kcv=1323&browseType=4&kpf=ANDROID_PHONE&ddpi=480&did=ANDROID_7fb9741952424985&power_mode=0&net=WIFI&app=0&did_tag=0&ud=0&c=SHENMA_SEM_FEISUO,74&sys=ANDROID_6.0.1&sw=1080&ftt=&keyconfig_state=2&rdid=ANDROID_e4fd5a29b62f427b&language=zh-cn&darkMode=false&totalMemory=3735&iuid=&did_gt=1625726874620&ver=UNKNOWN'
# 'abi=arm32androidApiLevel=23app=0appver=9.0.10.18068browseType=4c=SHENMA_SEM_FEISUO,74client_key=3c2cd3f3cold_launch_time_ms=1625726903606count=30country_code=cncs=falsedarkMode=falseddpi=480deviceBit=0did=ANDROID_7fb9741952424985did_gt=1625726874620did_tag=0egid=DFP85891D4542239E85F56593A3577E46D1FD65F690449E98E4F00BA9E3BC169ftt=hotfix_ver=isp=CMCCiuid=kcv=1323keyconfig_state=2kpf=ANDROID_PHONEkpn=KUAISHOUlang=zhlanguage=zh-cnmax_memory=256mod=Xiaomi(MI 5)nbh=0net=WIFInewOc=SHENMA_SEM_FEISUO,74oc=SHENMA_SEM_FEISUO,74os=androidpower_mode=0privacy=publicrdid=ANDROID_e4fd5a29b62f427breferer=ks://profile/2341923207/5196028119853470189/1_a/2001442404475105969_h89/8sbh=72sh=1920socName=Qualcomm MSM8996sw=1080sys=ANDROID_6.0.1totalMemory=3735ud=0user_id=2341923207ver=UNKNOWN'
# 'abi=arm32androidApiLevel=23app=0appver=9.0.10.18068browseType=4c=SHENMA_SEM_FEISUO,74client_key=3c2cd3f3cold_launch_time_ms=1625726903606'
